Vulnerability Database

296,746

Total vulnerabilities in the database

CVE-2024-23324

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

  • Published: Feb 10, 2024
  • Updated: Feb 16, 2024
  • CVE: CVE-2024-23324
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWEs:

Software From Fixed in
envoyproxy / envoy 1.29.0 1.29.1
envoyproxy / envoy 1.26.0 1.26.7
envoyproxy / envoy 1.28.0 1.28.1
envoyproxy / envoy 1.27.0 1.27.3